SOC › Module 8 › Lesson 2
Recovery Named
Recovery literacy — restore from backup, rebuild host, phased service return — on $HUNT_LAB recovery stubs.
Visual · t30_recovery_named
Recovery = named restore rows. $HUNT_LAB. Original Cyberlium.
Opening
Recovery brings services back safely — name restore, rebuild, and phased return on YOUR lab stubs before rushing prod online.
Recovery literacy names: restore from clean backup category, rebuild host from gold image category, phased service restoration (pilot group category), enhanced monitoring window post-recovery, and comms 'service restored' stub category. Analyst drafts recovery plan for $HUNT_LAB labeled host — pairs with eradication checklist Module 8-1, lists rollback if validation fails Module 8-3, UTC milestones — without restoring prod from unverified backup without RoE, without skipping validation to meet SLA fraudulently. Cyberlium on instructor recovery stub — defender operational vocabulary. Refused: prod recovery without authorization, restoring from known-compromised backup without note, hiding failed validation. Lab row: recovery plan template (method, order, monitoring window, UTC) for one lab host.
1. Named recovery methods
Backup restore, gold rebuild, phased return, monitoring window — four literacy anchors.
Recovery timing balances business need vs re-infection risk — document tradeoff on stub.
Command guide
Try these commands — Named recovery methods
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Recovery — https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final NIST recovery — https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final FIRST — https://www.first.org/
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
export HUNT_LAB=${HUNT_LAB:-$HOME/cyberlium-lab/t30-hunt}
cat > "$HUNT_LAB/ir/recovery-LAB-IR-001.md" <<'EOF'
# Recovery Plan — LAB-IR-001
## Restore operations (lab)
- [ ] Re-enable jsmith with new credentials after validation
- [ ] Return WIN-HUNT01 from quarantine VLAN to production VLAN (lab)
- [ ] Restore svc_backup if LAB-IR-002 cleared
- [ ] Verify business apps functional on lab VMs
## Monitoring post-recovery
- 72h enhanced logging on WIN-HUNT01/02
- Hunt query scheduled: rare parent + failed-then-success
## Communication
- Notify stakeholders: incident contained, recovery in progress (template)
EOFCommand — copy this
grep -E 'Recovery|quarantine|72h' "$HUNT_LAB/ir/recovery-LAB-IR-001.md"
Primary tools to practice this lesson: grep, python3. Reference sites: Recovery (https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final); NIST recovery (https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final); FIRST (https://www.first.org/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Pair with validation
No 'recovered' declaration before Module 8-3 checks — literacy gate.
Honest N/A if brief skips live restore demo — labeled.
3. Refused
No unauthorized prod recovery; no SLA fraud via false restored status.
Recovery literacy supports safe return — not reckless go-live.
4. What you ship: recovery plan row
Recovery method + phased order + monitoring window UTC + NEVER false restored line.
5. What you record before the next lesson
Recovery plan row path.
6. Wrong vs right: stranger prod vs YOUR hunt telemetry
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Mark employer service 'restored' without validation to beat SLA.
Right
Recovery plan from $HUNT_LAB host stub. Next: Validation Checks.
Mission: recovery plan row
1) Name three recovery methods. 2) Fill plan template for lab host. 3) Link validation gate from Module 8-3. 4) Write NEVER false restored status line.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Phased return — pilot group literacy?”
Knowledge Check
APPLY: Recovery literacy uses:
Multiple choice
Knowledge Check
APPLY: True or False: Declaring restored without validation is lab.
True or False
Knowledge Check
APPLY: Recovery plan should include:
Multiple choice